The top pick for most US CBD sellers is a 21+ age gate with scanned ID verification, a manual date-of-birth fallback, and a written refusal script at the counter or checkout. It wins on the criteria that actually decide compliance outcomes: it satisfies the strictest state you ship into, it adds seconds rather than minutes to a sale, it produces a record you can show an inspector, and it collects the least personal data needed to do the job.

Option: a 21+ gate for every order

This is the default that keeps a multi-state CBD shop out of trouble. Adult-use cannabis states set 21 as the purchase age, and a 21+ rule covers you in those states without asking staff to remember a patchwork of local limits.

Pros

  • One rule for the whole catalog, so no state-by-state logic to maintain at checkout.
  • Matches the age most shoppers already expect from a cannabis-adjacent retailer.
  • Reduces the chance a state regulator treats your store as a channel for underage access.

Cons

  • Blocks 18 to 20 year old buyers in states where CBD is legal for adults at 18.
  • Can cost conversions on low-THC topicals and pet products that carry no age restriction in some states.

Use it if you ship across state lines, sell any full-spectrum or THC-bearing product, or run a storefront where turnover makes per-product rules unrealistic.

Option: an 18+ gate with state overrides

Here the default sits at 18 and a rules layer raises the threshold when the shipping address falls in a 21+ state or a state with tighter hemp rules.

Pros

  • Keeps legal-for-adults CBD products open to the 18 to 20 audience in permissive states.
  • Lets you segment a catalog by product type instead of treating every SKU the same.

Cons

  • Depends on accurate address and geolocation data, and errors run in the direction of a violation.
  • Requires someone to track legislative changes and update the rules layer on a schedule.
  • Support staff need a decision tree, not a single sentence, when a customer disputes a block.

Use it if you sell only hemp-derived products, stay inside a small number of states, and can assign one person to own the rules table.

Criterion: automated ID scan versus manual date entry

Manual entry means the customer types a birth date. Scan means a camera, reader, or third-party service reads the document and returns pass or fail.

Pros of scanning

  • Catches altered and expired documents that a human eye misses at a busy counter.
  • Timestamps the check, which is the record that matters during an inspection.
  • Removes the judgment call from a clerk who is being pressured.

Cons of scanning

  • Hardware and service costs, plus staff time to learn the workflow.
  • Privacy questions from customers, so you need a clear answer about what is stored and what is deleted.
  • Can fail on worn IDs, out-of-state formats, or a bad camera angle.

Pros of manual entry

  • No hardware, no data retention question, and it works on any device.
  • Fast for repeat customers in a small shop.

Cons of manual entry

  • Anyone can type 1990, so it is a speed bump rather than a check.
  • No image or scan log means your evidence is a checkbox.

Use it if scanning fits your volume and budget. A hybrid works well: scan by default, manual entry only as a logged exception with a manager override.

Criterion: where the check happens

You can verify at site entry, at the cart, at checkout, or at the handoff for delivery and curbside.

Pros of early verification

  • Sets expectations before a customer builds a cart.
  • Cuts abandoned carts from a surprise block at payment.

Cons of early verification

  • Site-entry gates are easy to spoof because nothing is tied to a transaction.

Pros of handoff verification

  • Matches the face-to-face requirement that delivery rules in several states describe.
  • Confirms the person receiving the package is the person who ordered.

Cons of handoff verification

  • Failed checks mean a returned order, a refund, and a paid driver hour.

Use it if you run delivery. Best practice is to check twice: once online at checkout, again at the door with the physical ID in hand.

Criterion: records, scripts, and training

Rules differ by state, but the shape of a good program does not. Keep the minimum record, write the refusal script, and train on both.

Pros of a documented program

  • Gives you one story to tell a regulator, an insurer, and a payment processor.
  • Turns a new hire into a compliant clerk in one shift instead of one month.

Cons

  • Retention itself carries privacy obligations, so store pass or fail and a timestamp rather than a copy of the ID.
  • Scripts need refreshing when state law changes.

Use it if you have any staff at all. A one-page script beats good intentions when a line is forming.

How to choose

  1. Single-state storefront with no THC products: 18+ gate, scan at the counter, manual entry as a logged exception.
  2. Any full-spectrum or THC-bearing catalog: 21+ for everything, no exceptions.
  3. Multi-state shipper: 21+ default, address-based rules layer, scan at checkout, scan again at delivery.
  4. Kiosk or unattended retail: scan only, with no manual bypass path.

Whichever path you pick, write down the rule, the script, and the retention period before the next busy weekend. That written set is what you will actually hand over if anyone asks how you keep cannabis products away from minors.